Description
vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that poisons the GPU context, causing all subsequent requests to fail until the process restarts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vllm-project | vllm | < 0.28.0 | 0.28.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | vllm | < 0.28.0 | 0.28.0 | PYSEC-2026-3997 |
Advisories 1
- WID-SEC-2026-3187 vllm: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 9, 2026
References
- GitHub Security Advisory (GHSA-25q3-v2hm-8vpf) vendor-advisory
- VulnCheck Advisory: vLLM before 0.28.0 Denial of Service via negative token ID third-party-advisory